Stored Cross-Site Scripting Vulnerability in Contact Form and Calls To Action by vcita Plugin

CVE-2024-11886

What is CVE-2024-11886?

The Contact Form and Calls To Action by vcita plugin for WordPress exhibits a vulnerability that allows authenticated users with contributor-level access or higher to perform Stored Cross-Site Scripting. This occurs through the plugin's 'vCitaMeetingScheduler' shortcode, which fails to adequately sanitize input and escape output for user-supplied attributes. As a result, attackers can inject malicious scripts into web pages, which are executed whenever a user visits the compromised page, potentially leading to unauthorized actions or data exposure.

References